Step 53. pip and Virtual Environments — How to Bring the World’s Tools into Your Room

Level 1 — Programming and the Computer’s Insides | Difficulty ★★☆☆☆ | Estimated time: 3 hours

Prerequisites: Steps 41–52 complete. You know basic Python syntax and the standard library (Step 51). Today’s practice requires an internet connection.

• What you need: a PC with Python installed, PowerShell, an internet connection.
• Caution: starting today, you install code made by others onto your computer. So one new rule applies — check the spelling of package names exactly, and install only famous ones. The requests package we install today is one of the most widely used Python packages in the world.

In Step 51 we used the standard library, the built-in toolbox. But Python’s real power lies outside it. Hundreds of thousands of external tools uploaded by developers around the world — requests, which does a web request in two lines; openpyxl, which handles Excel; scapy, which touches network packets. The key that opens this bonus box is today’s protagonist, pip.

But installing recklessly causes problems. If project A requires version 1.0 of some tool and project B requires 2.0, you can’t install both on one computer at the same time — they collide. So the technique of making a small independent room for each project and installing only inside it is the virtual environment. Today you learn the whole system for using external tools: the key (pip), the room (virtual environment), and the room’s ingredient list (requirements.txt).

1. Learning Objectives

By the end of this chapter, you will be able to:

• Explain what pip and PyPI are, and what a dependency is
• Create, turn on (activate), and turn off a virtual environment (venv)
• Install the external package requests and fetch a web page in two lines
• Record a package list with requirements.txt and explain its purpose
• "Break and fix" an environment by uninstalling and reinstalling a package

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. pip — Python’s App Store

pip is the manager that finds, installs, and removes Python packages (bundles of tools made by others). It fetches them from a giant public repository called PyPI (Python Package Index) (pypi.org). A single line, pip install requests, finds requests in the repository and installs it on your computer. It’s the same place as a smartphone’s app store.

2-2. Dependencies — Tools of Tools

An installed package often needs other packages. This relationship is called a dependency. pip installs dependencies automatically along with the package. Convenient — but when versions tangle, you get situations where "it works in this project but not in that one."

2-3. Virtual Environments — An Independent Room per Project

What blocks that tangling at the source is the virtual environment. You make one independent space inside the project folder containing a Python executable and packages, and install only inside it. Each room can hold a different version of a tool, so collisions disappear. You make it with the venv module included with Python by default.

2-4. requirements.txt — The Ingredient List

A list file recording "what must be installed in this project," together with versions. With just this file, one line — pip install -r requirements.txt — reproduces the exact same environment on another computer. It’s the standard convention for collaboration and moving (to a new computer).

3. Follow Along

Today’s practice happens in PowerShell. Start from your project folder (security-study).

3-1. Checking pip’s Status

pip --version

pip 25.0.1 from C:...venvLibsite-packagespip (python 3.12)

(Measured 2026-09-09. The version number may differ.)

How to read the output: if you can see pip’s version and location, you’re ready. If you get an error, recheck the Python installation steps (environment variables) in Step 41.

3-2. Creating a Virtual Environment

python -m venv venv

(ends quietly with no output)

(Measured 2026-09-09. It may take a few dozen seconds.)

How to read the output: python -m venv means "Python, run the venv module," and the venv after it is the name of the room to create (by convention it’s named venv). When it finishes, a new folder called venv appears inside your folder. Open it in File Explorer and it looks like this (measured 2026-09-09):

venv
 ├─ Include
 ├─ Lib
 ├─ Scripts        ← python.exe, pip.exe, and Activate.ps1 live here
 └─ pyvenv.cfg

Ending quietly is normal. This is our independent room.

3-3. Turning the Virtual Environment On (Activation)

.venvScriptsActivate.ps1

(venv) PS C:UsersLeeDesktopsecurity-study>

How to read the output: when (venv) appears at the very front of the prompt, you’re inside the room. Everything you install in this state piles up only inside this room. When you want to turn it off, type deactivate.

Wall alert: many people get a red error (execution policy) here. If you get an error, read Wall 1 in section 6 below first, then come back.

Why: the habit of checking "is it on?" by the prompt is half of using virtual environments.

3-4. Installing requests and Your First Web Request

With the virtual environment on:

pip install requests

Collecting requests
...
Installing collected packages: urllib3, idna, charset_normalizer, certifi, requests
Successfully installed certifi-2026.7.22 charset_normalizer-3.5.1 idna-3.19 requests-2.34.2 urllib3-2.7.0

(Measured 2026-09-09. Versions vary from day to day.)

How to read the output: you ordered one package, requests, but five got installed. The other four are dependencies — the tools requests needs, which pip installed along with it automatically.

Now create fetch.py:

import requests

r = requests.get("https://example.com")
print("Status code:", r.status_code)
print("First 80 characters of the body:")
print(r.text[:80])

Status code: 200
First 80 characters of the body:
<!doctype html><html lang="en"><head><title>Example Domain</title><link rel="ico

(Measured 2026-09-09.)

How to read the output: status code 200 is the web’s answer meaning "success" (that number you saw in Step 34). You fetched a web page in just three lines. With the standard library alone, this job takes dozens of lines.

Why: tools that talk to the web are a basic skill for information gathering, API use, and CTF web problems.

3-5. Making the Installed List and the Ingredient List

pip list
pip freeze > requirements.txt

Package            Version
------------------ ---------
certifi            2026.7.22
charset-normalizer 3.5.1
idna               3.19
pip                25.0.1
requests           2.34.2
urllib3            2.7.0

(Measured 2026-09-09.)

Open the generated requirements.txt in Notepad:

certifi==2026.7.22
charset-normalizer==3.5.1
idna==3.19
requests==2.34.2
urllib3==2.7.0

(Measured 2026-09-09.)

How to read the output: pip list shows what’s installed in the room, and pip freeze prints that list in the "ingredient list with versions" format (name==version). We saved it to a file with >.

Predict: with this file, what happens with the single line pip install -r requirements.txt in a new virtual environment? The answer: "the same environment is reproduced in its entirety."

3-6. Turning the Virtual Environment Off and Coming Back

deactivate

How to read it: (venv) disappears from the prompt. You’ve come out of the room. To go back in, type the Activate command from 3-3 again. The room isn’t deleted — it stays as it is.

3-7. Package Info and Uninstalling — Break It and Fix It

Let’s check the ID card of the installed package, delete it, and install it again. With the virtual environment on:

pip show requests

Name: requests
Version: 2.34.2
Summary: Python HTTP for Humans.
Author-email: Kenneth Reitz <me@kennethreitz.org>
...

(Measured 2026-09-09.)

Now delete it, as an experiment:

pip uninstall requests

It shows the list to delete and asks Proceed (Y/n)? — press Y:

Uninstalling requests-2.34.2:
  Successfully uninstalled requests-2.34.2

In this state, run python fetch.py:

ModuleNotFoundError: No module named 'requests'

(Measured 2026-09-09. We verified everything: uninstall → error → recovery by reinstalling.)

How to read it: with requests gone, dying at the import is only natural. Reinstall with pip install requests and it recovers. This "break it and fix it" is the fastest training for handling environments. An environment is not something to touch timidly — it’s something you can remake anytime.

4. Missions & Exercises

Mission — Setting Up Your Own Tool Room

1. Create a virtual environment in the security-study folder and turn it on
2. Install requests, and write check_site.py, which prints three things: the status code, the response size (len(r.text)), and the response time (r.elapsed)
3. Receive the address to check as an argument (sys.argv, Step 51 review). Usage: python check_site.py https://example.com
4. Create requirements.txt and copy its contents into your notes
5. Practice turning the virtual environment off and on twice — confirm it’s on by the (venv) in the prompt

Try checking three or more places, changing the address. However, limit what you check to test sites like example.com or pages you made yourself.

Exercises

Q1. A single pip install requests installed five packages. What are the other four, and why does pip install them together?

Q2. How can you tell at a glance whether a virtual environment is on, and what problem occurs if you install without turning it on?

Q3. In requirements.txt’s requests==2.34.2, what does == mean, and how does this file make "environment moving" possible?

Q4. When moving a project to another computer, why don’t you copy the whole venv folder? What do you move instead, and in what order do you restore it on the new computer?

import sys
import requests

if len(sys.argv) < 2:
    print("Usage: python check_site.py <address>")
    sys.exit(1)

url = sys.argv[1]
try:
    r = requests.get(url, timeout=10)
except requests.exceptions.RequestException as e:
    print("Connection failed:", e)
    sys.exit(1)

print("Address:", url)
print("Status code:", r.status_code)
print("Response size:", len(r.text), "characters")
print("Response time:", r.elapsed)

6. Common Pitfalls & Fixes

Wall 1. A red execution policy error at Activate.ps1

Symptom: a red error saying "running scripts is disabled on this system…" (a typical message example):

...Activate.ps1 cannot be loaded because running scripts is disabled on this system...

Cause: PowerShell’s default security policy is blocking script execution. PowerShell is locked by default to prevent scripts from being run by just anyone.
Fix: type Set-ExecutionPolicy RemoteSigned -Scope CurrentUser into PowerShell and answer Y. It’s a setting that "allows local scripts on my computer," applied only to the current user. Then run Activate again. (Note: in the Command Prompt (cmd), you can turn it on without any policy using venvScriptsactivate.bat.)

Wall 2. It installed, but the import doesn’t work

Symptom: pip install succeeded, but the script raises ModuleNotFoundError: No module named 'requests' (reproduced in the 2026-09-09 measurement).
Cause: the place you installed differs from the place you’re running. The typical case: you installed into the virtual environment but ran with the Python outside it.
Fix: check that (venv) is in the prompt, and run with python fetch.py in that state. If you use an editor, you must also point the editor’s Python interpreter to the one inside venv.

Wall 3. Installing recklessly into the global environment

Symptom: everything was installed across the whole computer with no virtual environment, and versions tangle between projects later.
Cause: habit. At first making a room looks bothersome, so you skip it.
Fix: memorize "new project = new venv" like a formula. Making one new room is always faster than untangling a tangled environment. If a venv folder goes bad, you just delete it.

Wall 4. Lots of red text during installation and it fails

Symptom: the installation fails with a long error.
Cause: a network problem, a firewall, or a typo in the package name.
Fix: read the last line of the error. Could not find a version... means a name typo (typing requets instead of requests is common); a connection-related message means check the network.

Wall 5. pip can’t find python / or python doesn’t know pip

Symptom: pip works but python doesn’t, or vice versa.
Cause: the two are pointing to different Python installations. Common when multiple Pythons are installed on one computer.
Fix: use the form python -m pip install requests. It means "with this python’s pip," so the two can’t mismatch. Especially inside a virtual environment, this form is the most certain.

7. Summary

Today’s Concepts

Today’s Commands

The Instinct That Matters More Than Commands

Organized as a flow, today’s commands are six lines. Make a room (python -m venv venv), enter it (Activate), install (pip install), leave the list (pip freeze > requirements.txt), come out (deactivate), and elsewhere reproduce from the list (pip install -r requirements.txt). These six lines are the cycle Python developers run every day.

Remember two more things. First, pip install is "installing code made by someone else so it can run on my computer." The repository also hosts fakes with spellings similar to famous packages (typosquatting malware). Check the spelling of names, pick famous ones with many downloads, ignore "try installing this" from unknown sources — the moment you install a tool is the moment you grant trust. Second, make a SETUP.md in your project folder and write down what you did today — including "I got an execution policy error and solved it like this." What saves you two months from now is not memory but records.

Once every box is checked, Step 53 is complete.